Sample viewer

vx.netlux.org/Trojan.DOS.Direxe.e

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:46:57.217049087Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:57.218959435Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:46:57.220351429Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:57.221720634Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:57.232643068Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:57.2439764Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:57.245762387Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:46:57.248149498Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:46:57.249798897Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:46:57.251557868Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:46:57.252928747Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:46:57.255052797Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:46:57.256462439Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:46:57.257880207Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:46:57.260789547Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:46:57.262152412Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:46:57.263441122Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:46:57.273186508Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:57.274898449Z 53 PC: 13b6a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:46:57.276602161Z 37 PC: 13b7f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:57.282619078Z 37 PC: 13b87 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:57.284807102Z 37 PC: 13b8f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:57.286559103Z 37 PC: 13b97 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:57.289770988Z 68 PC: 14411 | I/O control for devices (Set for = 'SR�J�ӻ')
2018-12-17T22:46:57.362857664Z 37 PC: 13591 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:57.365029458Z 42 PC: 132f7 | Get date 0x132f7: xor ah, ah
0x132f9: les di, ptr [bp + 6]
0x132fc: stosw word ptr es:[di], ax
0x132fd: mov al, dl
0x132ff: les di, ptr [bp + 0xa]
0x13302: stosw word ptr es:[di], ax
0x13303: mov al, dh
0x13305: les di, ptr [bp + 0xe]
0x13308: stosw word ptr es:[di], ax
0x13309: xchg ax, cx
0x1330a: les di, ptr [bp + 0x12]
0x1330d: stosw word ptr es:[di], ax
0x1330e: pop bp
0x1330f: retf 0x10
0x13312: push bp
0x13313: mov bp, sp
0x13315: mov cx, word ptr [bp + 0xa]
0x13318: mov dh, byte ptr [bp + 8]
0x1331b: mov dl, byte ptr [bp + 6]
0x1331e: mov ah, 0x2b
2018-12-17T22:46:57.368686719Z 53 PC: 134bf | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:57.371155262Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:57.372814792Z 53 PC: 134bf | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:46:57.374534566Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:46:57.377099428Z 53 PC: 134bf | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:57.37856765Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:57.379960979Z 53 PC: 134bf | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:57.383677036Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:57.385115506Z 53 PC: 134bf | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:57.386631291Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:57.389146218Z 53 PC: 134bf | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:57.390543439Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:57.391943753Z 53 PC: 134bf | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:46:57.394266785Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:46:57.395991547Z 53 PC: 134bf | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:46:57.397621698Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:46:57.399431228Z 53 PC: 134bf | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:46:57.401305577Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:46:57.402895882Z 53 PC: 134bf | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:46:57.404511165Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:46:57.411071787Z 53 PC: 134bf | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:46:57.41315114Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:46:57.415657229Z 53 PC: 134bf | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:46:57.426534443Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:46:57.428125268Z 53 PC: 134bf | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:46:57.429726876Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:46:57.431629724Z 53 PC: 134bf | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:46:57.432891915Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:46:57.433962321Z 53 PC: 134bf | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:46:57.435716375Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:46:57.437053583Z 53 PC: 134bf | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:46:57.438432603Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:46:57.440302772Z 53 PC: 134bf | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:46:57.441647311Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:46:57.443464971Z 53 PC: 134bf | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:57.444985503Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:57.447005438Z 53 PC: 134bf | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:46:57.449156258Z 37 PC: 134c8 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:46:57.450928822Z 41 PC: 13476 | Parse filename
2018-12-17T22:46:57.453211532Z 41 PC: 13484 | Parse filename
2018-12-17T22:46:57.454820306Z 75 PC: 1348f | Execute program
2018-12-17T22:46:57.477896921Z 80 PC: 18c39 | Set current PSP
2018-12-17T22:46:57.480313706Z 48 PC: 18c3e | Get DOS version
2018-12-17T22:46:57.482439955Z 99 PC: 1f420 | Get DBCS lead byte table pointer
2018-12-17T22:46:57.485736023Z 101 PC: 18cc4 | Get extended country info
2018-12-17T22:46:57.48843026Z 99 PC: 18cca | Get DBCS lead byte table pointer
2018-12-17T22:46:57.490575716Z 74 PC: 18d2c | Reallocate memory
2018-12-17T22:46:57.492581426Z 25 PC: 18d63 | Get default drive
2018-12-17T22:46:57.49509853Z 37 PC: 18823 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:46:57.497606966Z 37 PC: 1882a | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:57.499290731Z 37 PC: 18831 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:57.504440923Z 74 PC: 179cc | Reallocate memory
2018-12-17T22:46:57.507430306Z 72 PC: 17a0d | Allocate memory
2018-12-17T22:46:57.509572595Z 72 PC: 17a45 | Allocate memory
2018-12-17T22:46:57.511865315Z 72 PC: 17a4d | Allocate memory